Skip to content

Commit eba554f

Browse files
acx1729acx1729
committed
feat: multiple cleanups
1 parent 0540a85 commit eba554f

File tree

5,009 files changed

+184914
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

5,009 files changed

+184914
-0
lines changed

‎compliance/controls/aws/aws_account_alternate_contact_security_registered.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
ID: aws_account_alternate_contact_security_registered
2+
Title: "Security contact information should be provided for an AWS account"
3+
Description: "This control checks if an AWS Web Services (AWS) account has security contact information. The control fails if security contact information is not provided for the account."
4+
Connector:
5+
- aws
6+
Query:
7+
Engine: odysseus-v0.0.1
8+
QueryToExecute: |
9+
with alternate_security_contact as (
10+
select
11+
name,
12+
account_id
13+
from
14+
aws_account_alternate_contact
15+
where
16+
contact_type = 'SECURITY'
17+
)
18+
select
19+
arn as resource,
20+
kaytu_account_id as kaytu_account_id,
21+
kaytu_resource_id as kaytu_resource_id,
22+
case
23+
when a.partition = 'aws-us-gov' then 'info'
24+
-- Name is a required field if setting a security contact
25+
when c.name is not null then 'ok'
26+
else 'alarm'
27+
end as status,
28+
case
29+
when a.partition = 'aws-us-gov' then a.title || ' in GovCloud, manual verification required.'
30+
when c.name is not null then a.title || ' has security contact ' || c.name || ' registered.'
31+
else a.title || ' security contact not registered.'
32+
end as reason
33+
, a.account_id
34+
from
35+
aws_account as a
36+
left join alternate_security_contact as c on c.account_id = a.account_id;
37+
PrimaryTable: aws_account
38+
ListOfTables:
39+
- aws_account
40+
- aws_account_alternate_contact
41+
Parameters: []
42+
Severity: low
43+
Tags:
44+
category:
45+
- Compliance
46+
cis:
47+
- "true"
48+
cis_item_id:
49+
- "1.18"
50+
cis_level:
51+
- "1"
52+
cis_section_id:
53+
- "1"
54+
cis_type:
55+
- not_scored
56+
cis_version:
57+
- v1.2.0
58+
plugin:
59+
- aws
60+
service:
61+
- AWS/IAM

‎compliance/controls/aws/aws_account_part_of_organizations.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
ID: aws_account_part_of_organizations
2+
Title: "AWS account should be part of AWS Organizations"
3+
Description: "Ensure that an AWS account is part of AWS Organizations. The rule is non-compliant if an AWS account is not part of AWS Organizations or AWS Organizations master account ID does not match rule parameter MasterAccountId."
4+
Connector:
5+
- aws
6+
Query:
7+
Engine: odysseus-v0.0.1
8+
QueryToExecute: |
9+
select
10+
arn as resource,
11+
kaytu_account_id as kaytu_account_id,
12+
kaytu_resource_id as kaytu_resource_id,
13+
case
14+
when organization_id is not null then 'ok'
15+
else 'alarm'
16+
end as status,
17+
case
18+
when organization_id is not null then title || ' is part of organization(s).'
19+
else title || ' is not part of organization.'
20+
end as reason
21+
, region, account_id
22+
from
23+
aws_account;
24+
PrimaryTable: aws_account
25+
ListOfTables:
26+
- aws_account
27+
Parameters: []
28+
Severity: medium
29+
Tags:
30+
category:
31+
- Compliance
32+
cis_controls_v8_ig1:
33+
- "true"
34+
gxp_21_cfr_part_11:
35+
- "true"
36+
nist_800_53_rev_5:
37+
- "true"
38+
nist_csf:
39+
- "true"
40+
plugin:
41+
- aws
42+
service:
43+
- AWS/IAM

‎compliance/controls/aws/aws_acm_certificate_expires_30_days.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
ID: aws_acm_certificate_expires_30_days
2+
Title: "ACM certificates should not expire within 30 days"
3+
Description: "Ensure network integrity is protected by ensuring X509 certificates are issued by AWS ACM."
4+
Connector:
5+
- aws
6+
Query:
7+
Engine: odysseus-v0.0.1
8+
QueryToExecute: |
9+
select
10+
certificate_arn as resource,
11+
kaytu_account_id as kaytu_account_id,
12+
kaytu_resource_id as kaytu_resource_id,
13+
case
14+
when renewal_eligibility = 'INELIGIBLE' then 'skip'
15+
when date(not_after) - date(current_date) >= 30 then 'ok'
16+
else 'alarm'
17+
end as status,
18+
case
19+
when renewal_eligibility = 'INELIGIBLE' then title || ' not eligible for renewal.'
20+
else title || ' expires ' || to_char(not_after, 'DD-Mon-YYYY') ||
21+
' (' || extract(day from not_after - current_date) || ' days).'
22+
end as reason
23+
24+
, region, account_id
25+
from
26+
aws_acm_certificate;
27+
PrimaryTable: aws_acm_certificate
28+
ListOfTables:
29+
- aws_acm_certificate
30+
Parameters: []
31+
Severity: high
32+
Tags:
33+
category:
34+
- Compliance
35+
cisa_cyber_essentials:
36+
- "true"
37+
fedramp_low_rev_4:
38+
- "true"
39+
fedramp_moderate_rev_4:
40+
- "true"
41+
ffiec:
42+
- "true"
43+
gdpr:
44+
- "true"
45+
hipaa_final_omnibus_security_rule_2013:
46+
- "true"
47+
hipaa_security_rule_2003:
48+
- "true"
49+
nist_800_171_rev_2:
50+
- "true"
51+
nist_800_53_rev_4:
52+
- "true"
53+
nist_800_53_rev_5:
54+
- "true"
55+
nist_csf:
56+
- "true"
57+
pci_dss_v321:
58+
- "true"
59+
plugin:
60+
- aws
61+
rbi_cyber_security:
62+
- "true"
63+
service:
64+
- AWS/ACM
65+
soc_2:
66+
- "true"

‎compliance/controls/aws/aws_acm_certificate_no_failed_certificate.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
ID: aws_acm_certificate_no_failed_certificate
2+
Title: "Ensure that ACM certificates are not in failed state"
3+
Description: "This control ensures that ACM certificates are not in failed state."
4+
Connector:
5+
- aws
6+
Query:
7+
Engine: odysseus-v0.0.1
8+
QueryToExecute: |-
9+
select
10+
certificate_arn as resource,
11+
kaytu_account_id as kaytu_account_id,
12+
kaytu_resource_id as kaytu_resource_id,
13+
case
14+
when status in ('VALIDATION_TIMED_OUT', 'FAILED') then 'alarm'
15+
else 'ok'
16+
end as status,
17+
title || ' status is ' || status || '.' as reason
18+
19+
20+
from
21+
aws_acm_certificate;
22+
PrimaryTable: aws_acm_certificate
23+
ListOfTables:
24+
- aws_acm_certificate
25+
Parameters: []
26+
Severity: low
27+
Tags: {}

‎compliance/controls/aws/aws_acm_certificate_no_pending_validation_certificate.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
ID: aws_acm_certificate_no_pending_validation_certificate
2+
Title: "Ensure that ACM certificates are not in pending validation state"
3+
Description: "This control ensures that ACM certificates are not in pending validation state. When certificates are not validated within 72 hours after the request is made, those certificates become invalid."
4+
Connector:
5+
- aws
6+
Query:
7+
Engine: odysseus-v0.0.1
8+
QueryToExecute: |-
9+
select
10+
certificate_arn as resource,
11+
kaytu_account_id as kaytu_account_id,
12+
kaytu_resource_id as kaytu_resource_id,
13+
case
14+
when status = 'PENDING_VALIDATION' then 'info'
15+
else 'ok'
16+
end as status,
17+
title || ' status is ' || status || '.' as reason
18+
19+
20+
from
21+
aws_acm_certificate;
22+
PrimaryTable: aws_acm_certificate
23+
ListOfTables:
24+
- aws_acm_certificate
25+
Parameters: []
26+
Severity: low
27+
Tags: {}

‎compliance/controls/aws/aws_acm_certificate_no_wildcard_domain_name.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
ID: aws_acm_certificate_no_wildcard_domain_name
2+
Title: "ACM certificates should not use wildcard certificates"
3+
Description: "Ensure that ACM single domain name certificates are used instead of wildcard certificates within your AWS account in order to follow security best practices and protect each domain/subdomain with its own unique private key."
4+
Connector:
5+
- aws
6+
Query:
7+
Engine: odysseus-v0.0.1
8+
QueryToExecute: |-
9+
select
10+
certificate_arn as resource,
11+
kaytu_account_id as kaytu_account_id,
12+
kaytu_resource_id as kaytu_resource_id,
13+
case
14+
when domain_name like '*%' then 'alarm'
15+
else 'ok'
16+
end as status,
17+
case
18+
when domain_name like '*%' then title || ' uses wildcard domain name.'
19+
else title || ' does not use wildcard domain name.'
20+
end as reason
21+
from
22+
aws_acm_certificate;
23+
PrimaryTable: aws_acm_certificate
24+
ListOfTables:
25+
- aws_acm_certificate
26+
Parameters: []
27+
Severity: low
28+
Tags: {}

‎compliance/controls/aws/aws_acm_certificate_not_expired.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
ID: aws_acm_certificate_not_expired
2+
Title: "Ensure that all the expired ACM certificates are removed"
3+
Description: "This control ensures that all expired ACM certificates are removed from AWS account."
4+
Connector:
5+
- aws
6+
Query:
7+
Engine: odysseus-v0.0.1
8+
QueryToExecute: |-
9+
select
10+
certificate_arn as resource,
11+
kaytu_account_id as kaytu_account_id,
12+
kaytu_resource_id as kaytu_resource_id,
13+
case
14+
when renewal_eligibility = 'INELIGIBLE' then 'skip'
15+
when date(not_after) < (current_date - interval '1' minute) then 'alarm'
16+
else 'ok'
17+
end as status,
18+
case
19+
when renewal_eligibility = 'INELIGIBLE' then title || ' not eligible for renewal.'
20+
when date(not_after) < (current_date - interval '1' minute) then title || ' expired ' || to_char(not_after, 'DD-Mon-YYYY') ||
21+
' (' || extract(day from not_after - current_date) || ' days ago).'
22+
else title || ' expires ' || to_char(not_after, 'DD-Mon-YYYY') ||
23+
' (' || extract(day from not_after - current_date) || ' days).'
24+
end as reason
25+
26+
27+
from
28+
aws_acm_certificate;
29+
PrimaryTable: aws_acm_certificate
30+
ListOfTables:
31+
- aws_acm_certificate
32+
Parameters: []
33+
Severity: low
34+
Tags: {}

‎compliance/controls/aws/aws_acm_certificate_rsa_key_length_2048_bits_or_greater.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
ID: aws_acm_certificate_rsa_key_length_2048_bits_or_greater
2+
Title: "RSA certificates managed by ACM should use a key length of at least 2,048 bits"
3+
Description: "This control checks whether RSA certificates managed by AWS Certificate Manager use a key length of at least 2,048 bits. The control fails if the key length is smaller than 2,048 bits."
4+
Connector:
5+
- aws
6+
Query:
7+
Engine: odysseus-v0.0.1
8+
QueryToExecute: |-
9+
select
10+
certificate_arn as resource,
11+
kaytu_account_id as kaytu_account_id,
12+
kaytu_resource_id as kaytu_resource_id,
13+
case
14+
when not key_algorithm like 'RSA-%' then 'skip'
15+
when key_algorithm = 'RSA_1024' then 'alarm'
16+
else 'ok'
17+
end as status,
18+
case
19+
when not key_algorithm like 'RSA-%' then title || ' is not a RSA certificate.'
20+
when key_algorithm = 'RSA_1024' then title || ' is using 1024 bits key length.'
21+
else title || ' is using ' || split_part(key_algorithm, '-', 2) || ' bits key length.'
22+
end as reason
23+
24+
25+
from
26+
aws_acm_certificate;
27+
PrimaryTable: aws_acm_certificate
28+
ListOfTables:
29+
- aws_acm_certificate
30+
Parameters: []
31+
Severity: low
32+
Tags: {}

‎compliance/controls/aws/aws_acm_certificate_transparency_logging_enabled.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
ID: aws_acm_certificate_transparency_logging_enabled
2+
Title: "ACM certificates should have transparency logging enabled"
3+
Description: "Ensure ACM certificates transparency logging is enabled as certificate transparency logging guards against SSL/TLS certificates issued by mistake or by a compromised certificate authority."
4+
Connector:
5+
- aws
6+
Query:
7+
Engine: odysseus-v0.0.1
8+
QueryToExecute: |-
9+
select
10+
certificate_arn as resource,
11+
kaytu_account_id as kaytu_account_id,
12+
kaytu_resource_id as kaytu_resource_id,
13+
case
14+
when type = 'IMPORTED' then 'skip'
15+
when certificate_transparency_logging_preference = 'ENABLED' then 'ok'
16+
else 'alarm'
17+
end as status,
18+
case
19+
when type = 'IMPORTED' then title || ' is imported.'
20+
when certificate_transparency_logging_preference = 'ENABLED' then title || ' transparency logging enabled.'
21+
else title || ' transparency logging disabled.'
22+
end as reason
23+
from
24+
aws_acm_certificate;
25+
PrimaryTable: aws_acm_certificate
26+
ListOfTables:
27+
- aws_acm_certificate
28+
Parameters: []
29+
Severity: low
30+
Tags: {}

‎compliance/controls/aws/aws_acmpca_root_certificate_authority_disabled.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
ID: aws_acmpca_root_certificate_authority_disabled
2+
Title: "AWS Private CA root certificate authority should be disabled"
3+
Description: "This control checks if AWS Private CA has a root certificate authority (CA) that is disabled. The control fails if the root CA is enabled."
4+
Connector:
5+
- aws
6+
Query:
7+
Engine: odysseus-v0.0.1
8+
QueryToExecute: |-
9+
select
10+
arn as resource,
11+
kaytu_account_id as kaytu_account_id,
12+
kaytu_resource_id as kaytu_resource_id,
13+
case
14+
when type <> 'ROOT' then 'skip'
15+
when status = 'DISABLED' then 'ok'
16+
else 'alarm'
17+
end as status,
18+
case
19+
when type <> 'ROOT' then title || ' is not root CA.'
20+
when status = 'DISABLED' then title || ' root CA disabled.'
21+
else title || ' root CA not disabled.'
22+
end as reason
23+
24+
25+
from
26+
aws_acmpca_certificate_authority;
27+
PrimaryTable: aws_acmpca_certificate_authority
28+
ListOfTables:
29+
- aws_acmpca_certificate_authority
30+
Parameters: []
31+
Severity: low
32+
Tags: {}

0 commit comments

Comments
 (0)